3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e.exe
Size 515KB
Sample260502-kjmxvafx2q
SHA256 3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e
MD5 4050608b10c679cbe53395d724bc7376
SHA1 65a1d7c0cffe1aa98b5722edf40f90d5dae41f76
SHA512 ea58e75e64eb3039717189d67e64cc8d6025ce04033fa0041981428505783bba24428dd2820782ac5e96fd71f71aca98728a8b44f1556d1d6ec37e23d3c99380
SSDEEP 6144:bev2ub1ch6+otjW50LjJy/FWLWPdDaEiFrr9UFuir0cEOkCybEaQRXr9HNdvOa:bcbOIzi0XJy/FWLWPDSOkx2LIa
TLSH
T140B47D2AF6A0C076C4B39679C49686A7FBB1B42137204ACFA39147561F637E2BD3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	3364	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e.exe

C:\Users\Admin\AppData\Local\Temp\3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e.exe
"C:\Users\Admin\AppData\Local\Temp\3b05a98ba4ea99f0e86c069092395d3277fe88879bc9995aff3d35fc7761637e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 228
  2⤵
  - Program crash
  PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3364 -ip 3364
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads